Full-stack and frontend developers
Secure web application development
Browser-facing risks: output encoding, cross-site requests, redirects, uploads and the sign-in flow. Finishes with reviewing whole features the way a security reviewer would.
- 10/3
Output and navigation
Render user content safely and only redirect where you intend.
- Encode output to stop stored XSSSCD-02Secure CodingFoundationalNot solved
Comments are rendered with string concatenation. Encode author and text so markup is displayed, not executed.
- Stop open redirects after loginSCD-07Secure CodingFoundationalNot solved
The login page redirects to any ?next= value. Allow same-site paths only.
- Review a pull request: React profile pageCRV-02Secure Code ReviewFoundationalNot solved
A frontend PR renders user bios, stores a token and redirects after saving. Find the client-side defects.
- 20/1
Requests the user did not mean to send
Defend state-changing endpoints against cross-site request forgery.
- Fix a CSRF token checkSCD-12Secure CodingFoundationalNot solved
The API has double-submit CSRF protection, but the check lets requests without a token through. Close the gaps.
- 30/3
Sign-in and account recovery
Build a login and password-reset flow that does not leak or hand over accounts.
- Review a pull request: login endpointCRV-07Secure Code ReviewFoundationalNot solved
A rewrite of the login route adds logging and a remember-me cookie. The password check is fine — almost nothing else is.
- Fix predictable password-reset tokensSCD-13Secure CodingFoundationalNot solved
Reset tokens come from Math.random() and the clock, and stay valid for a week. Make them unguessable and short-lived.
- Fix password storageSCD-11Secure CodingPractitionerNot solved
Passwords are stored as unsalted MD5. Replace it with a salted, slow key-derivation function and a constant-time check.
- 40/3
Files and features
Review complete features for the defects that tests rarely catch.
- Review a pull request: ticket attachmentsCRV-06Secure Code ReviewPractitionerNot solved
Customers can now attach files to support tickets. Upload handling is one of the riskiest features to get wrong — review it.
- Review a pull request: customer APICRV-01Secure Code ReviewPractitionerNot solved
A backend PR adds customer search, bulk export and support password resets. Find every security defect before it merges.
- Review a pull request: validation helpersCRV-05Secure Code ReviewPractitionerNot solved
New validators for sign-up and search. Some regexes take exponential time on the right input. Find them.